Spyware / Malware / Virus Removal

Event Log error (at41.job)

15 min read

Looking for the outcome? Ask AI

MRW1 Topic Starter

Post #1November 13, 2008, 4:08 AM UTC last edited November 14, 2008, 4:18 AM UTC

I am receiving error reports in Event Log. AT41.job (and all other .job files). My understanding is that this malware. I have seen other posts about this subject and understand that the cure is system specific.

I am running Panda antivirus but it doesn't find and/or remove the problem.

Here is my Hijackthis log for review .

Thanks in advance

Mike

MBAM SCAN AT BOTTOM OF POST…

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:42:30 PM, on 11/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\ApvxdWin.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DISC\DiscGui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MarketBrowser\lmt\mktbrws.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [] C:\PROGRA~1\MOZILL~1\FIREFOX.EXE http://www.symantec.com/techsupp/servlet/P…000097.000001cf
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MarketBrowser.lnk = C:\Program Files\MarketBrowser\lmt\mktbrws.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430014015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430005718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Panda Host Service (PSHost) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

–
End of file - 10570 bytes

Folders Infected: 8
Files Infected: 24

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c24d7016-d00f-41ef-9781-984b6b5ff38f} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ec88fcd0-2ed5-4d65-9b4c-71d146b43a2e} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e532cfb1-5edd-4663-8c22-bcd67b5e5bd4} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4e980492-027b-47f1-a7ab-ab086dacbb9e} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5ead8321-fcbb-4c3f-888c-ac373d366c3f} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\SysRestore.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Ascentive (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\PC SpeedScan Pro (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Center (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Hotbar (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlockerUtility_Icons (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlocker (Adware.Hotbar) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Ascentive\PC SpeedScan Pro\PCSpeedScan.exe (Rogue.PCSpeedScan) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\PC SpeedScan Pro\SSRes.dll (Rogue.SpywareStop) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Center\APCLang.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Center\ApcMain.exe (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ConTest.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SysRestore.dll (Rogue.AscentivePerformance) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Centertemp.htm (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed\AS.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed\ascbalon.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed\ascIP95.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed\ascIPNT.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\ActiveSpeed\ASRes.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\PC SpeedScan Pro\WatchList.ini (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Center\GUID (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\Ascentive\Performance Center\SOUND.WAV (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive\ActiveSpeed.lnk (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive\PC SpeedScan Pro.lnk (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\Programs\Ascentive\Performance Center.lnk (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlockerUtility_Icons\Registryrepair.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlockerUtility_Icons\Software_Online_8.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlockerUtility_Icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrator\Application Data\SpamBlocker\Personal Folders (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\7dfxYxG7.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\V032CCNE.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.

COMBO Fix and HJTHIS LOGS

HJTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:17 PM, on 11/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MarketBrowser\lmt\mktbrws.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [] C:\PROGRA~1\MOZILL~1\FIREFOX.EXE http://www.symantec.com/techsupp/servlet/P…000097.000001cf
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MarketBrowser.lnk = C:\Program Files\MarketBrowser\lmt\mktbrws.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430014015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430005718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Panda Host Service (PSHost) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

–
End of file - 9975 bytes

Combo
ComboFix 08-11-12.01 - HP_Administrator 2008-11-13 22:06:02.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.427 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\bold.log
c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
c:\documents and settings\HP_Administrator\Application Data\inst.exe
c:\windows\IE4 Error Log.txt
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-10-14 to 2008-11-14 )))))))))))))))))))))))))))))))
.

2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 11:59 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-13 11:54 . 2008-11-13 11:54 d——– c:\program files\ERUNT
2008-11-12 12:02 . 2008-09-04 11:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:02 . 2008-10-24 05:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 00:46 . 2008-11-11 00:46 d——– c:\program files\Common Files\Adobe AIR
2008-11-10 15:18 . 2008-11-10 15:18 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-09 17:47 . 2008-11-09 17:47 d——– c:\program files\Enigma Software Group
2008-11-09 17:18 . 2008-11-09 17:41 d——– c:\program files\Exterminate It!
2008-11-08 12:47 . 2005-08-13 21:05 516,096 ——— c:\windows\system32\ati2sgag.exe
2008-11-08 12:28 . 2008-11-08 12:48 d——– c:\program files\ATI Technologies
2008-11-08 00:53 . 2008-11-08 00:53 d——– C:\ATI
2008-11-07 23:45 . 2008-11-13 12:00 265,600 –a—— c:\windows\system32\drivers\APPFCONT.DAT.bck
2008-11-07 23:45 . 2008-11-13 12:00 265,600 –a—— c:\windows\system32\drivers\APPFCONT.DAT
2008-11-07 23:45 . 2008-06-18 16:06 193,792 –a—— c:\windows\system32\drivers\idsflt.sys
2008-11-07 23:45 . 2008-07-11 14:58 158,848 –a—— c:\windows\system32\drivers\NETFLTDI.SYS
2008-11-07 23:45 . 2008-06-25 15:42 73,728 –a—— c:\windows\system32\drivers\APPFLT.SYS
2008-11-07 23:45 . 2008-06-18 16:06 52,992 –a—— c:\windows\system32\drivers\dsaflt.sys
2008-11-07 23:45 . 2008-06-18 16:06 46,720 –a—— c:\windows\system32\drivers\wnmflt.sys
2008-11-07 23:45 . 2008-03-28 11:25 22,072 –a—— c:\windows\system32\drivers\fnetmon.sys
2008-11-07 23:45 . 2008-11-13 07:18 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG.bck
2008-11-07 23:45 . 2008-11-13 07:18 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG
2008-11-07 23:16 . 2008-11-13 14:23 8,627 –a—— c:\windows\system32\PAV_FOG.OPC
2008-11-07 23:10 . 2008-11-13 07:17 13,880 –a—— c:\windows\system32\drivers\COMFiltr.sys
2008-11-07 23:09 . 2008-04-28 17:35 84,024 –a—— c:\windows\system32\drivers\pavdrv51.sys
2008-11-07 23:09 . 2008-11-07 23:09 249 –a—— c:\windows\system32\PavCPL.dat
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\windows\system32\PAV
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Panda Security
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\All Users\Application Data\Panda Security
2008-11-07 23:08 . 2008-06-18 18:03 520,448 –a—— c:\windows\system32\PavSHook.dll
2008-11-07 23:08 . 2003-10-22 18:23 446,464 –a—— c:\windows\system32\HHActiveX.dll
2008-11-07 23:08 . 2008-06-26 11:25 197,888 –a—— c:\windows\system32\drivers\neti1634.sys
2008-11-07 23:08 . 2008-06-24 14:48 193,280 –a—— c:\windows\system32\TpUtil.dll
2008-11-07 23:08 . 2007-02-08 11:53 107,568 –a—— c:\windows\system32\SYSTOOLS.DLL
2008-11-07 23:08 . 2008-06-18 18:03 87,296 –a—— c:\windows\system32\PavLspHook.dll
2008-11-07 23:08 . 2008-03-18 16:58 58,672 –a—— c:\windows\system32\avldr.dll
2008-11-07 23:08 . 2008-06-18 18:03 55,552 –a—— c:\windows\system32\pavipc.dll
2008-11-07 23:08 . 2007-03-15 19:38 54,832 –a—— c:\windows\system32\pavcpl.cpl
2008-11-07 23:05 . 2008-02-07 12:03 179,640 –a—— c:\windows\system32\drivers\PavProc.sys
2008-11-07 23:05 . 2008-03-04 15:59 41,144 –a—— c:\windows\system32\drivers\ShlDrv51.sys
2008-11-07 22:58 . 2008-11-07 22:58 d——– c:\program files\Common Files\Panda Security
2008-11-07 13:32 . 2008-11-07 23:08 d——– c:\program files\Panda Security
2008-11-07 13:32 . 2008-06-19 17:24 28,544 –a—— c:\windows\system32\drivers\pavboot.sys
2008-11-07 13:24 . 2008-11-07 13:24 d——– c:\program files\Trend Micro
2008-11-07 11:55 . 2008-11-07 11:55 d–h—– c:\windows\system32\GroupPolicy
2008-11-06 16:14 . 2008-11-06 16:14 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\ATI
2008-11-06 15:39 . 2004-02-24 16:25 19,188 –a—— c:\windows\Q883956Readme.rtf
2008-11-06 12:29 . 2008-11-06 12:30 664 –a—— c:\windows\system32\d3d9caps.dat
2008-11-06 11:09 . 2008-11-06 11:09 552 –a—— c:\windows\system32\d3d8caps.dat
2008-11-06 10:16 . 2006-04-02 16:52 1,851,546 –a—— c:\windows\system32\gdql_lsa.dll
2008-11-06 10:16 . 2006-01-16 22:08 683,150 –a—— c:\windows\system32\qdiaglsa.ocx
2008-11-06 10:16 . 2005-08-30 12:23 208,896 –a—— c:\windows\system32\GTDownLS_125.ocx
2008-11-06 10:16 . 2005-11-21 13:17 135,168 –a—— c:\windows\system32\GoProto.dll
2008-11-06 10:16 . 2008-11-06 10:16 29,184 –a—— c:\windows\system32\drivers\goprot51.sys
2008-11-06 10:16 . 2004-06-09 09:29 6,977 –a—— c:\windows\system32\DDMI2.sys
2008-11-06 10:16 . 2005-03-13 16:54 6,656 –a—— c:\windows\system32\DLPT2.sys
2008-11-05 23:46 . 2008-11-05 23:47 d——– c:\program files\FMS
2008-11-05 23:22 . 2008-11-06 10:04 d–h—– c:\windows\msdownld.tmp
2008-11-05 23:22 . 2008-11-05 23:22 d——– c:\windows\Logs
2008-11-05 21:00 . 2008-11-05 21:00 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WildTangent
2008-11-05 21:00 . 2008-11-05 21:00 d–h—– c:\documents and settings\All Users\Application Data\WildTangent
2008-11-05 20:20 . 2008-11-05 20:20 d——– c:\program files\Transcendental Technologies
2008-11-04 23:39 . 2008-11-04 23:39 d——– c:\program files\SVKSystems
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\drivers\hidusb.sys
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\dllcache\hidusb.sys
2008-11-04 16:10 . 2008-11-06 17:47 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Vso
2008-11-01 09:58 . 2008-11-07 08:35 d——– c:\documents and settings\LocalService\Application Data\SACore
2008-11-01 08:25 . 2008-11-01 08:25 d–h—– c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-11-01 08:24 . 2008-11-01 08:24 d——– c:\program files\SiteAdvisor
2008-11-01 08:12 . 2008-11-07 23:36 d–h—– c:\documents and settings\All Users\Application Data\McAfee
2008-11-01 08:10 . 2008-11-01 08:10 d——– c:\windows\system32\kodak
2008-11-01 02:12 . 2008-06-13 05:05 272,128 ——— c:\windows\system32\dllcache\bthport.sys
2008-11-01 02:12 . 2008-08-14 04:04 138,496 ——— c:\windows\system32\dllcache\afd.sys
2008-11-01 02:11 . 2008-09-15 06:12 1,846,400 ——— c:\windows\system32\dllcache\win32k.sys
2008-11-01 02:11 . 2008-04-11 13:04 691,712 ——— c:\windows\system32\dllcache\inetcomm.dll
2008-11-01 02:11 . 2008-09-08 04:41 333,824 ——— c:\windows\system32\dllcache\srv.sys
2008-11-01 02:11 . 2008-05-01 08:33 331,776 ——— c:\windows\system32\dllcache\msadce.dll
2008-11-01 02:11 . 2008-05-08 08:02 203,136 ——— c:\windows\system32\dllcache\rmcast.sys
2008-11-01 02:10 . 2008-10-15 10:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\scripting
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\en
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\bits
2008-11-01 01:21 . 2008-04-13 18:12 1,737,856 ——— c:\windows\system32\mtxparhd.dll
2008-10-31 22:51 . 2008-07-18 22:10 45,768 –a—— c:\windows\system32\wups2.dll
2008-10-31 22:51 . 2008-07-18 22:10 33,992 –a—— c:\windows\system32\wucltui.dll.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuaucpl.cpl.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuapi.dll.mui
2008-10-31 22:51 . 2008-07-18 22:08 20,680 –a—— c:\windows\system32\wuaueng.dll.mui
2008-10-31 21:38 . 2008-10-31 21:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Ascentive
2008-10-31 08:18 . 2008-10-31 08:21 d——– c:\program files\Microsoft Picture It! 7
2008-10-31 05:06 . 2007-07-03 11:48 36,864 –a—— c:\windows\system32\ascbalon.dll
2008-10-31 02:34 . 2008-10-31 02:34 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\AdobeUM
2008-10-31 01:43 . 2008-10-31 01:43 d–h—– c:\documents and settings\All Users\Application Data\Ascentive
2008-10-31 01:29 . 2008-02-28 17:57 12,800 –a—— c:\windows\system32\EKDeviceServices.dll
2008-10-31 01:28 . 2008-02-15 06:03 335,872 –a—— c:\windows\system32\EKIJ5000MON.dll
2008-10-31 01:22 . 2008-10-31 01:30 1,563 –a—— c:\windows\system32\InstallUtil.InstallLog
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\wiafbdrv.dll
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\dllcache\wiafbdrv.dll
2008-10-31 00:38 . 2008-10-31 00:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Skinux
2008-10-31 00:33 . 2008-10-31 01:36 d—-c— c:\windows\system32\DRVSTORE
2008-10-30 23:09 . 2008-10-30 23:09 d–hs—- c:\documents and settings\HP_Administrator.MRWOFFICE\UserData
2008-10-30 22:14 . 2008-10-30 22:14 d——– C:\SystemRoot
2008-10-30 22:12 . 2008-10-30 22:12 d——– C:\temp
2008-10-30 22:12 . 2008-10-30 22:12 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WinBatch
2008-10-30 21:40 . 2004-05-11 09:53 626,960 -ra—— c:\windows\system32\hpvaut32.dll
2008-10-30 21:40 . 2004-05-11 09:53 487,424 -ra—— c:\windows\system32\hpvcp70.dll
2008-10-30 21:40 . 2004-05-11 09:53 344,064 -ra—— c:\windows\system32\hpvcr70.dll
2008-10-29 23:23 . 2004-08-04 00:56 159,232 –a—— c:\windows\system32\ptpusd.dll
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\drivers\usbscan.sys
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\dllcache\usbscan.sys
2008-10-29 23:23 . 2001-08-17 22:36 5,632 –a—— c:\windows\system32\ptpusb.dll
2008-10-29 23:10 . 2008-04-13 12:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-10-29 23:10 . 2008-04-13 12:47 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2008-10-29 23:07 . 2007-08-10 12:56 303,104 –a—— c:\windows\system32\ciplListBar.ocx
2008-10-29 23:07 . 2007-08-10 12:56 224,016 –a—— c:\windows\system32\tabctl32.ocx
2008-10-29 23:07 . 2007-08-10 12:56 155,648 –a—— c:\windows\system32\ciplImageList.ocx
2008-10-29 23:06 . 2008-10-29 23:06 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\InstallShield
2008-10-29 21:04 . 2008-10-29 21:04 d——– c:\windows\system32\LogFiles
2008-10-29 20:54 . 2008-10-29 20:54 d——– c:\program files\Windows Sidebar
2008-10-29 20:53 . 2008-11-01 06:58 10,671 –a—— c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-29 20:53 . 2008-11-01 06:58 805 –a—— c:\windows\system32\drivers\SYMEVENT.INF
2008-10-29 18:23 . 2008-10-29 18:23 d——– C:\MSXML3msms

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 04:01 10,607 —-a-w c:\program files\hijackthis.log
2008-11-12 02:56 ——— d—–w c:\program files\Common Files\Adobe
2008-11-10 00:13 ——— d—–w c:\program files\WildTangent
2008-11-08 05:08 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-07 16:04 ——— d—–w c:\program files\Common Files\Real
2008-11-06 16:16 ——— d—–w c:\program files\Linksys EasyLink Advisor
2008-11-01 14:05 ——— d—–w c:\program files\Norton SystemWorks
2008-11-01 14:05 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-01 13:32 ——— d–h–w c:\documents and settings\All Users\Application Data\Symantec
2008-10-31 07:19 ——— d—–w c:\program files\Kodak
2008-10-31 07:17 ——— d–h–w c:\documents and settings\All Users\Application Data\Kodak
2008-10-31 04:22 ——— d—–w c:\program files\Hewlett-Packard
2008-10-31 04:04 139,264 —-a-w c:\windows\system32\hpzjrd01.dll
2008-10-29 23:05 ——— d—–w c:\program files\Quicken
2008-10-29 22:41 ——— d—–w c:\program files\PC-Doctor 5 for Windows
2008-10-29 22:39 ——— d—–w c:\program files\Google
2008-10-29 22:24 ——— d—–w c:\program files\Java
2008-10-29 14:42 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Vso
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-10 14:01 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\INITIO
2008-10-09 18:05 ——— d—–w c:\program files\Common Files\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\ArcSoft
2008-10-05 00:20 ——— d—–w c:\program files\InterVideo
2008-10-04 13:44 ——— d–h–w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 22:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 09:33 2,023,936 —-a-w c:\windows\system32\ntkrnlpa.exe
2007-09-09 12:18 47,360 ——w c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2005-05-26 19:35 1,422 —-a-w c:\program files\ReadMe.txt
2007-03-07 01:32 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007030620070307\index.dat
2007-06-23 23:29 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062320070624\index.dat
2007-06-27 02:23 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062620070627\index.dat
.

——- Sigcheck ——-

2005-03-01 18:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 10:12 2059392 ba4b97c00a437c1cc3da365d93ee1e9d c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 03:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2008-08-14 14:39 2066048 a25e9b86effb2af33bf51e676b68bfb0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
2004-08-03 21:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-01 18:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
2006-12-19 06:55 2057600 1d659bfb788ed2ba45075624b748d249 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
2008-08-14 03:33 2066048 4ac58f03eb94a72809949d757fc39d80 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
2008-08-14 03:33 2023936 8206b5f94a6a9450e934029420c1693f c:\windows\system32\ntkrnlpa.exe

2005-03-01 19:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 10:51 2182016 cef243f6defd20be4adde26c7ecacb54 c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 03:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2008-08-14 15:11 2189184 31914172342bff330063f343ac6958fe c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
2004-08-03 22:20 2180992 ce218bc7088681faa06633e218596ca7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-01 18:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
2006-12-19 08:17 2180352 8f0deab1f81fb83f9c5995853ce48b9f c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
2008-08-14 04:11 2189184 eeaf32f8e15a24f62becb1bd403bb5c5 c:\windows\Driver Cache\i386\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
2008-08-14 04:09 2145280 f6f8245b3a2e9ca834dd318e7ae0c6d0 c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-05 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
""="c:\progra~1\MOZILL~1\FIREFOX.EXE" [2008-11-12 7676528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"DISCover"="c:\program files\DISC\DISCover.exe" [2005-11-11 1064960]
"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-11-11 61440]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-02-15 1052672]
"APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-14 57344]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
TheSpringBox.lnk - c:\program files\TheSpringBox\TheSpringBox.exe [2007-06-14 1695679]

c:\documents and settings\HP_Administrator.MRWOFFICE\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-08-14 57344]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
MarketBrowser.lnk - c:\program files\MarketBrowser\lmt\mktbrws.exe [2008-10-28 2971648]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= c:\windows\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= c:\windows\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]
backup=c:\windows\pss\TotalMedia Backup Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
backup=c:\windows\pss\Updates From HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
–a—— 2006-04-02 20:07 389120 c:\program files\Linksys EasyLink Advisor\Linksys EasyLink Advisor\LinksysAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2007-05-08 16:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2008-06-19 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [2008-06-25 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [2008-06-18 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [2008-03-28 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [2008-06-18 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [2008-07-11 14:58 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\Drivers\ShlDrv51.sys [2008-03-04 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [2008-06-18 46720]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda [ ]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2008-02-07 179640]
R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 28928]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [ ]
R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [2008-11-13 13880]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\DRIVERS\neti1634.sys [2008-06-26 197888]
R3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [ ]
R3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [ ]
S3 GameConsoleService;GameConsoleService;c:\program files\WildTangent\Apps\HP Game Console\GameConsoleService.exe [2008-05-05 165416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-11-11 c:\windows\Tasks\At1.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At10.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At11.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At12.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At13.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At14.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At15.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At16.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At17.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At18.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At19.job
- c:\windows\system32\V032CCNE.exe []

2008-11-07 c:\windows\Tasks\At2.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At20.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At21.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At22.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At23.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At24.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At25.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At26.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At27.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At28.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At29.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At3.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At30.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At31.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At32.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At33.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At34.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At35.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-11 c:\windows\Tasks\At36.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At37.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At38.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At39.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At4.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At40.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At41.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At42.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At43.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-11 c:\windows\Tasks\At44.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At45.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At46.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At47.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At48.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At5.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At6.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At7.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At8.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At9.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-06 22:53]

2008-11-12 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]

2008-11-10 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PCDrProfiler - (no file)

.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Mozilla\Firefox\Profiles\kaa3p6qu.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.weather.com/weather/local/38060?lswe=38060&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-13 22:10:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-13 22:11:46
ComboFix-quarantined-files.txt 2008-11-14 04:11:43

Pre-Run: 80,674,504,704 bytes free
Post-Run: 81,136,394,240 bytes free

440 — E O F — 2008-11-12 18:04:36

little eagle

Post #2November 13, 2008, 5:06 PM UTC

Run - ATF Cleaner instructions here.

—————-

Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location and post it here. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

MRW1

Post #3November 14, 2008, 3:28 AM UTC

MBAM scan posted…

little eagle

Post #4November 14, 2008, 3:51 AM UTC

Sorry about that. it was not MBAM I wanted it was combofix.

Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re enable the protection again afterwards before connecting to the net

2.Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.

MRW1

Post #5November 14, 2008, 4:19 AM UTC

Combo and Hijack posted. Thanks Mike

little eagle

Post #6November 14, 2008, 12:38 PM UTC

Please do not edit your post. When posting a new log use add reply.

Then add the requested log or logs.

Reboot and rescan with HiJackThis and post a new log here.
Also please describe how your computer behaves at the moment.

MRW1

Post #7November 14, 2008, 3:46 PM UTC

HJTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:44:54 AM, on 11/14/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\PROGRAM FILES\PANDA SECURITY\PANDA ANTIVIRUS PRO 2009\WebProxy.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\DISC\DiscGui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MarketBrowser\lmt\mktbrws.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [] C:\PROGRA~1\MOZILL~1\FIREFOX.EXE http://www.symantec.com/techsupp/servlet/P…000097.000001cf
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MarketBrowser.lnk = C:\Program Files\MarketBrowser\lmt\mktbrws.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430014015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430005718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Panda Host Service (PSHost) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

–
End of file - 10289 bytes

Computer seems to be doing ok right now. Not hanging up.

little eagle

Post #8November 14, 2008, 3:58 PM UTC

Close all programs leaving only HijackThis running. Place a check against each of the following,

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - (no file)
O15 - Trusted Zone: http://*.trymedia.com (HKLM)

Click on Fix Checked when finished and exit HijackThis.

————————————————————–

Then run combofix again and post the log.

MRW1

Post #9November 14, 2008, 4:20 PM UTC

ComboFix 08-11-12.01 - HP_Administrator 2008-11-14 10:12:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.615 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-10-14 to 2008-11-14 )))))))))))))))))))))))))))))))
.

2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 11:59 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-13 11:54 . 2008-11-13 11:54 d——– c:\program files\ERUNT
2008-11-12 12:02 . 2008-09-04 11:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:02 . 2008-10-24 05:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 00:46 . 2008-11-11 00:46 d——– c:\program files\Common Files\Adobe AIR
2008-11-10 15:18 . 2008-11-10 15:18 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-09 17:47 . 2008-11-09 17:47 d——– c:\program files\Enigma Software Group
2008-11-09 17:18 . 2008-11-09 17:41 d——– c:\program files\Exterminate It!
2008-11-08 12:47 . 2005-08-13 21:05 516,096 ——— c:\windows\system32\ati2sgag.exe
2008-11-08 12:28 . 2008-11-08 12:48 d——– c:\program files\ATI Technologies
2008-11-08 00:53 . 2008-11-08 00:53 d——– C:\ATI
2008-11-07 23:45 . 2008-11-13 22:15 263,428 –a—— c:\windows\system32\drivers\APPFCONT.DAT.bck
2008-11-07 23:45 . 2008-11-13 22:15 263,428 –a—— c:\windows\system32\drivers\APPFCONT.DAT
2008-11-07 23:45 . 2008-06-18 16:06 193,792 –a—— c:\windows\system32\drivers\idsflt.sys
2008-11-07 23:45 . 2008-07-11 14:58 158,848 –a—— c:\windows\system32\drivers\NETFLTDI.SYS
2008-11-07 23:45 . 2008-06-25 15:42 73,728 –a—— c:\windows\system32\drivers\APPFLT.SYS
2008-11-07 23:45 . 2008-06-18 16:06 52,992 –a—— c:\windows\system32\drivers\dsaflt.sys
2008-11-07 23:45 . 2008-06-18 16:06 46,720 –a—— c:\windows\system32\drivers\wnmflt.sys
2008-11-07 23:45 . 2008-03-28 11:25 22,072 –a—— c:\windows\system32\drivers\fnetmon.sys
2008-11-07 23:45 . 2008-11-14 09:20 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG.bck
2008-11-07 23:45 . 2008-11-14 09:20 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG
2008-11-07 23:16 . 2008-11-13 14:23 8,627 –a—— c:\windows\system32\PAV_FOG.OPC
2008-11-07 23:10 . 2008-11-14 09:20 13,880 –a—— c:\windows\system32\drivers\COMFiltr.sys
2008-11-07 23:09 . 2008-04-28 17:35 84,024 –a—— c:\windows\system32\drivers\pavdrv51.sys
2008-11-07 23:09 . 2008-11-07 23:09 249 –a—— c:\windows\system32\PavCPL.dat
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\windows\system32\PAV
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Panda Security
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\All Users\Application Data\Panda Security
2008-11-07 23:08 . 2008-06-18 18:03 520,448 –a—— c:\windows\system32\PavSHook.dll
2008-11-07 23:08 . 2003-10-22 18:23 446,464 –a—— c:\windows\system32\HHActiveX.dll
2008-11-07 23:08 . 2008-06-26 11:25 197,888 –a—— c:\windows\system32\drivers\neti1634.sys
2008-11-07 23:08 . 2008-06-24 14:48 193,280 –a—— c:\windows\system32\TpUtil.dll
2008-11-07 23:08 . 2007-02-08 11:53 107,568 –a—— c:\windows\system32\SYSTOOLS.DLL
2008-11-07 23:08 . 2008-06-18 18:03 87,296 –a—— c:\windows\system32\PavLspHook.dll
2008-11-07 23:08 . 2008-03-18 16:58 58,672 –a—— c:\windows\system32\avldr.dll
2008-11-07 23:08 . 2008-06-18 18:03 55,552 –a—— c:\windows\system32\pavipc.dll
2008-11-07 23:08 . 2007-03-15 19:38 54,832 –a—— c:\windows\system32\pavcpl.cpl
2008-11-07 23:05 . 2008-02-07 12:03 179,640 –a—— c:\windows\system32\drivers\PavProc.sys
2008-11-07 23:05 . 2008-03-04 15:59 41,144 –a—— c:\windows\system32\drivers\ShlDrv51.sys
2008-11-07 22:58 . 2008-11-07 22:58 d——– c:\program files\Common Files\Panda Security
2008-11-07 13:32 . 2008-11-07 23:08 d——– c:\program files\Panda Security
2008-11-07 13:32 . 2008-06-19 17:24 28,544 –a—— c:\windows\system32\drivers\pavboot.sys
2008-11-07 13:24 . 2008-11-07 13:24 d——– c:\program files\Trend Micro
2008-11-07 11:55 . 2008-11-07 11:55 d–h—– c:\windows\system32\GroupPolicy
2008-11-06 16:14 . 2008-11-06 16:14 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\ATI
2008-11-06 15:39 . 2004-02-24 16:25 19,188 –a—— c:\windows\Q883956Readme.rtf
2008-11-06 12:29 . 2008-11-06 12:30 664 –a—— c:\windows\system32\d3d9caps.dat
2008-11-06 11:09 . 2008-11-06 11:09 552 –a—— c:\windows\system32\d3d8caps.dat
2008-11-06 10:16 . 2006-04-02 16:52 1,851,546 –a—— c:\windows\system32\gdql_lsa.dll
2008-11-06 10:16 . 2006-01-16 22:08 683,150 –a—— c:\windows\system32\qdiaglsa.ocx
2008-11-06 10:16 . 2005-08-30 12:23 208,896 –a—— c:\windows\system32\GTDownLS_125.ocx
2008-11-06 10:16 . 2005-11-21 13:17 135,168 –a—— c:\windows\system32\GoProto.dll
2008-11-06 10:16 . 2008-11-06 10:16 29,184 –a—— c:\windows\system32\drivers\goprot51.sys
2008-11-06 10:16 . 2004-06-09 09:29 6,977 –a—— c:\windows\system32\DDMI2.sys
2008-11-06 10:16 . 2005-03-13 16:54 6,656 –a—— c:\windows\system32\DLPT2.sys
2008-11-05 23:46 . 2008-11-05 23:47 d——– c:\program files\FMS
2008-11-05 23:22 . 2008-11-06 10:04 d–h—– c:\windows\msdownld.tmp
2008-11-05 23:22 . 2008-11-05 23:22 d——– c:\windows\Logs
2008-11-05 21:00 . 2008-11-05 21:00 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WildTangent
2008-11-05 21:00 . 2008-11-05 21:00 d–h—– c:\documents and settings\All Users\Application Data\WildTangent
2008-11-05 20:20 . 2008-11-05 20:20 d——– c:\program files\Transcendental Technologies
2008-11-04 23:39 . 2008-11-04 23:39 d——– c:\program files\SVKSystems
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\drivers\hidusb.sys
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\dllcache\hidusb.sys
2008-11-04 16:10 . 2008-11-06 17:47 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Vso
2008-11-01 09:58 . 2008-11-07 08:35 d——– c:\documents and settings\LocalService\Application Data\SACore
2008-11-01 08:25 . 2008-11-01 08:25 d–h—– c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-11-01 08:24 . 2008-11-01 08:24 d——– c:\program files\SiteAdvisor
2008-11-01 08:12 . 2008-11-07 23:36 d–h—– c:\documents and settings\All Users\Application Data\McAfee
2008-11-01 08:10 . 2008-11-01 08:10 d——– c:\windows\system32\kodak
2008-11-01 02:12 . 2008-06-13 05:05 272,128 ——— c:\windows\system32\dllcache\bthport.sys
2008-11-01 02:12 . 2008-08-14 04:04 138,496 ——— c:\windows\system32\dllcache\afd.sys
2008-11-01 02:11 . 2008-09-15 06:12 1,846,400 ——— c:\windows\system32\dllcache\win32k.sys
2008-11-01 02:11 . 2008-04-11 13:04 691,712 ——— c:\windows\system32\dllcache\inetcomm.dll
2008-11-01 02:11 . 2008-09-08 04:41 333,824 ——— c:\windows\system32\dllcache\srv.sys
2008-11-01 02:11 . 2008-05-01 08:33 331,776 ——— c:\windows\system32\dllcache\msadce.dll
2008-11-01 02:11 . 2008-05-08 08:02 203,136 ——— c:\windows\system32\dllcache\rmcast.sys
2008-11-01 02:10 . 2008-10-15 10:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\scripting
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\en
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\bits
2008-11-01 01:21 . 2008-04-13 18:12 1,737,856 ——— c:\windows\system32\mtxparhd.dll
2008-10-31 22:51 . 2008-07-18 22:10 45,768 –a—— c:\windows\system32\wups2.dll
2008-10-31 22:51 . 2008-07-18 22:10 33,992 –a—— c:\windows\system32\wucltui.dll.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuaucpl.cpl.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuapi.dll.mui
2008-10-31 22:51 . 2008-07-18 22:08 20,680 –a—— c:\windows\system32\wuaueng.dll.mui
2008-10-31 21:38 . 2008-10-31 21:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Ascentive
2008-10-31 08:18 . 2008-10-31 08:21 d——– c:\program files\Microsoft Picture It! 7
2008-10-31 05:06 . 2007-07-03 11:48 36,864 –a—— c:\windows\system32\ascbalon.dll
2008-10-31 02:34 . 2008-10-31 02:34 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\AdobeUM
2008-10-31 01:43 . 2008-10-31 01:43 d–h—– c:\documents and settings\All Users\Application Data\Ascentive
2008-10-31 01:29 . 2008-02-28 17:57 12,800 –a—— c:\windows\system32\EKDeviceServices.dll
2008-10-31 01:28 . 2008-02-15 06:03 335,872 –a—— c:\windows\system32\EKIJ5000MON.dll
2008-10-31 01:22 . 2008-10-31 01:30 1,563 –a—— c:\windows\system32\InstallUtil.InstallLog
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\wiafbdrv.dll
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\dllcache\wiafbdrv.dll
2008-10-31 00:38 . 2008-10-31 00:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Skinux
2008-10-31 00:33 . 2008-10-31 01:36 d—-c— c:\windows\system32\DRVSTORE
2008-10-30 23:09 . 2008-10-30 23:09 d–hs—- c:\documents and settings\HP_Administrator.MRWOFFICE\UserData
2008-10-30 22:14 . 2008-10-30 22:14 d——– C:\SystemRoot
2008-10-30 22:12 . 2008-10-30 22:12 d——– C:\temp
2008-10-30 22:12 . 2008-10-30 22:12 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WinBatch
2008-10-30 21:40 . 2004-05-11 09:53 626,960 -ra—— c:\windows\system32\hpvaut32.dll
2008-10-30 21:40 . 2004-05-11 09:53 487,424 -ra—— c:\windows\system32\hpvcp70.dll
2008-10-30 21:40 . 2004-05-11 09:53 344,064 -ra—— c:\windows\system32\hpvcr70.dll
2008-10-29 23:23 . 2004-08-04 00:56 159,232 –a—— c:\windows\system32\ptpusd.dll
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\drivers\usbscan.sys
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\dllcache\usbscan.sys
2008-10-29 23:23 . 2001-08-17 22:36 5,632 –a—— c:\windows\system32\ptpusb.dll
2008-10-29 23:10 . 2008-04-13 12:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-10-29 23:10 . 2008-04-13 12:47 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2008-10-29 23:07 . 2007-08-10 12:56 303,104 –a—— c:\windows\system32\ciplListBar.ocx
2008-10-29 23:07 . 2007-08-10 12:56 224,016 –a—— c:\windows\system32\tabctl32.ocx
2008-10-29 23:07 . 2007-08-10 12:56 155,648 –a—— c:\windows\system32\ciplImageList.ocx
2008-10-29 23:06 . 2008-10-29 23:06 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\InstallShield
2008-10-29 21:04 . 2008-10-29 21:04 d——– c:\windows\system32\LogFiles
2008-10-29 20:54 . 2008-10-29 20:54 d——– c:\program files\Windows Sidebar
2008-10-29 20:53 . 2008-11-01 06:58 10,671 –a—— c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-29 20:53 . 2008-11-01 06:58 805 –a—— c:\windows\system32\drivers\SYMEVENT.INF
2008-10-29 18:23 . 2008-10-29 18:23 d——– C:\MSXML3msms

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 04:01 10,607 —-a-w c:\program files\hijackthis.log
2008-11-12 02:56 ——— d—–w c:\program files\Common Files\Adobe
2008-11-10 00:13 ——— d—–w c:\program files\WildTangent
2008-11-08 05:08 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-07 16:04 ——— d—–w c:\program files\Common Files\Real
2008-11-06 16:16 ——— d—–w c:\program files\Linksys EasyLink Advisor
2008-11-01 14:05 ——— d—–w c:\program files\Norton SystemWorks
2008-11-01 14:05 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-01 13:32 ——— d–h–w c:\documents and settings\All Users\Application Data\Symantec
2008-10-31 07:19 ——— d—–w c:\program files\Kodak
2008-10-31 07:17 ——— d–h–w c:\documents and settings\All Users\Application Data\Kodak
2008-10-31 04:22 ——— d—–w c:\program files\Hewlett-Packard
2008-10-31 04:04 139,264 —-a-w c:\windows\system32\hpzjrd01.dll
2008-10-29 23:05 ——— d—–w c:\program files\Quicken
2008-10-29 22:41 ——— d—–w c:\program files\PC-Doctor 5 for Windows
2008-10-29 22:39 ——— d—–w c:\program files\Google
2008-10-29 22:24 ——— d—–w c:\program files\Java
2008-10-29 14:42 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Vso
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-10 14:01 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\INITIO
2008-10-09 18:05 ——— d—–w c:\program files\Common Files\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\ArcSoft
2008-10-05 00:20 ——— d—–w c:\program files\InterVideo
2008-10-04 13:44 ——— d–h–w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 22:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 09:33 2,023,936 —-a-w c:\windows\system32\ntkrnlpa.exe
2007-09-09 12:18 47,360 ——w c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2005-05-26 19:35 1,422 —-a-w c:\program files\ReadMe.txt
2007-03-07 01:32 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007030620070307\index.dat
2007-06-23 23:29 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062320070624\index.dat
2007-06-27 02:23 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062620070627\index.dat
.

——- Sigcheck ——-

2005-03-01 18:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 10:12 2059392 ba4b97c00a437c1cc3da365d93ee1e9d c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 03:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2008-08-14 14:39 2066048 a25e9b86effb2af33bf51e676b68bfb0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
2004-08-03 21:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-01 18:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
2006-12-19 06:55 2057600 1d659bfb788ed2ba45075624b748d249 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
2008-08-14 03:33 2066048 4ac58f03eb94a72809949d757fc39d80 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
2008-08-14 03:33 2023936 8206b5f94a6a9450e934029420c1693f c:\windows\system32\ntkrnlpa.exe

2005-03-01 19:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 10:51 2182016 cef243f6defd20be4adde26c7ecacb54 c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 03:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2008-08-14 15:11 2189184 31914172342bff330063f343ac6958fe c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
2004-08-03 22:20 2180992 ce218bc7088681faa06633e218596ca7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-01 18:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
2006-12-19 08:17 2180352 8f0deab1f81fb83f9c5995853ce48b9f c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
2008-08-14 04:11 2189184 eeaf32f8e15a24f62becb1bd403bb5c5 c:\windows\Driver Cache\i386\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
2008-08-14 04:09 2145280 f6f8245b3a2e9ca834dd318e7ae0c6d0 c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-13_22.11.27.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\ERDNT.EXE
+ 2008-11-14 15:20:27 2,818,048 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\Users\00000001\NTUSER.DAT
+ 2008-11-14 15:20:27 159,744 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\Users\00000002\UsrClass.dat
- 2008-11-08 05:10:46 61,558 —-a-w c:\windows\system32\perfc009.dat
+ 2008-11-14 15:24:18 61,558 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-08 05:10:46 402,576 —-a-w c:\windows\system32\perfh009.dat
+ 2008-11-14 15:24:18 402,576 —-a-w c:\windows\system32\perfh009.dat
+ 2008-11-14 15:20:09 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_374.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-05 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
""="c:\progra~1\MOZILL~1\FIREFOX.EXE" [2008-11-12 7676528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"DISCover"="c:\program files\DISC\DISCover.exe" [2005-11-11 1064960]
"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-11-11 61440]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-02-15 1052672]
"APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-14 57344]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
TheSpringBox.lnk - c:\program files\TheSpringBox\TheSpringBox.exe [2007-06-14 1695679]

c:\documents and settings\HP_Administrator.MRWOFFICE\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-08-14 57344]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
MarketBrowser.lnk - c:\program files\MarketBrowser\lmt\mktbrws.exe [2008-10-28 2971648]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= c:\windows\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= c:\windows\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]
backup=c:\windows\pss\TotalMedia Backup Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
backup=c:\windows\pss\Updates From HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
–a—— 2006-04-02 20:07 389120 c:\program files\Linksys EasyLink Advisor\Linksys EasyLink Advisor\LinksysAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2007-05-08 16:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2008-06-19 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [2008-06-25 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [2008-06-18 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [2008-03-28 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [2008-06-18 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [2008-07-11 14:58 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\Drivers\ShlDrv51.sys [2008-03-04 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [2008-06-18 46720]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda [ ]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2008-02-07 179640]
R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 28928]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [ ]
R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [2008-11-14 13880]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\DRIVERS\neti1634.sys [2008-06-26 197888]
R3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [ ]
R3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [ ]
S3 GameConsoleService;GameConsoleService;c:\program files\WildTangent\Apps\HP Game Console\GameConsoleService.exe [2008-05-05 165416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
.
Contents of the 'Scheduled Tasks' folder

2008-11-11 c:\windows\Tasks\At1.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At10.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At11.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At12.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At13.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At14.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At15.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At16.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At17.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At18.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At19.job
- c:\windows\system32\V032CCNE.exe []

2008-11-07 c:\windows\Tasks\At2.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At20.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At21.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At22.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At23.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At24.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At25.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At26.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At27.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At28.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At29.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At3.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At30.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At31.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At32.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At33.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At34.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At35.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-11 c:\windows\Tasks\At36.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At37.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At38.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At39.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At4.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At40.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At41.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At42.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At43.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-11 c:\windows\Tasks\At44.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At45.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At46.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At47.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At48.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At5.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At6.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At7.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At8.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At9.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-06 22:53]

2008-11-12 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]

2008-11-10 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Mozilla\Firefox\Profiles\kaa3p6qu.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.weather.com/weather/local/38060?lswe=38060&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-14 10:16:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-14 10:17:44
ComboFix-quarantined-files.txt 2008-11-14 16:17:41
ComboFix2.txt 2008-11-14 04:11:47

Pre-Run: 81,417,539,584 bytes free
Post-Run: 81,410,686,976 bytes free

440 — E O F — 2008-11-12 18:04:36

little eagle

Post #10November 14, 2008, 4:30 PM UTC

Please download DDS and save it to your desktop.

Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS.txt will open.
Click Yes at the next prompt for Optional Scan.
Save both reports to your desktop.

—————————————————

Please include the contents of the following in your next reply:

DDS.txt

Please attach the second file; Attach.txt. To attach a file, do the following:

Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on [external image: Posted Image] to insert the attachment into your post

MRW1

Post #11November 14, 2008, 9:21 PM UTC

DDS (Version 1.0) - NTFSx86
Run by [removed] at 15:11:15.18 on Fri 11/14/2008
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.479 [GMT -6:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost -k Panda
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\snmp.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MarketBrowser\lmt\mktbrws.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\DVDFab 5\DVDFab.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\HP_Administrator.MRWOFFICE\Desktop\dds.scr

============== Psuedo HJT Report ===============

uStart Page = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
BHO: {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [] c:\progra~1\mozill~1\FIREFOX.EXE http://www.symantec.com/techsupp/servlet/P…000097.000001cf
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE
mRun: [HPHUPD08] c:\program files\hp\digital imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe
mRun: [DISCover] c:\program files\disc\DISCover.exe
mRun: [DiscUpdateManager] c:\program files\disc\DiscUpdateMgr.exe
mRun: [DMAScheduler] c:\program files\sonic\digitalmedia plus\digitalmedia archive\DMAScheduler.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe
mRun: [HPHUPD06] c:\program files\hp\{aac4fc36-8f89-4587-8dd3-ebc57c83374d}\hphupd06.exe
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe
mRun: [APVXDWIN] "c:\program files\panda security\panda antivirus pro 2009\APVXDWIN.EXE" /s
mRun: [SCANINICIO] "c:\program files\panda security\panda antivirus pro 2009\Inicio.exe"
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime
StartupFolder: c:\docume~1\hp_adm~1.mrw\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\aticat~1.lnk - c:\program files\ati technologies\ati.ace\CLI.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\market~1.lnk - c:\program files\marketbrowser\lmt\mktbrws.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office11\ONENOTEM.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789}
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} -
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avldr - avldr.dll

============= SERVICES / DRIVERS ===============

R0 pavboot;Panda boot driver;c:\windows\system32\drivers\pavboot.sys
R1 APPFLT;App Filter Plugin;\??\c:\windows\system32\drivers\APPFLT.SYS
R1 DSAFLT;DSA Filter Plugin;\??\c:\windows\system32\drivers\DSAFLT.SYS
R1 FNETMON;NetMon Filter Plugin;\??\c:\windows\system32\drivers\fnetmon.SYS
R1 IDSFLT;Ids Filter Plugin;\??\c:\windows\system32\drivers\IDSFLT.SYS
R1 NETFLTDI;Panda Net Driver [TDI Layer];\??\c:\windows\system32\drivers\NETFLTDI.SYS
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys
R1 WNMFLT;Wifi Monitor Filter Plugin;\??\c:\windows\system32\drivers\WNMFLT.SYS
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda
R2 PavProc;Panda Process Protection Driver;\??\c:\windows\system32\drivers\PavProc.sys
R2 PskSvcRetail;Panda PSK service;"c:\program files\panda security\panda antivirus pro 2009\PskSvc.exe"
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys
R3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\drivers\COMFiltr.sys
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\drivers\neti1634.sys
R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys
R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys
S2 KodakSvc;Kodak AiO Device Service;
S3 GameConsoleService;GameConsoleService;"c:\program files\wildtangent\apps\hp game console\GameConsoleService.exe"

=============== Created Last 30 ================

2008-11-13 22:05 161,792 a——- c:\windows\SWREG.exe
2008-11-13 22:05 98,816 a——- c:\windows\sed.exe
2008-11-13 11:59 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Malwarebytes
2008-11-13 11:59 15,504 a——- c:\windows\system32\drivers\mbam.sys
2008-11-13 11:59 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 11:59 –d—– c:\program files\Malwarebytes' Anti-Malware
2008-11-13 11:59 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-11-12 12:02 455,296 ——– c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 12:02 1,106,944 ——– c:\windows\system32\dllcache\msxml3.dll
2008-11-10 15:18 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-09 17:47 –d—– c:\program files\Enigma Software Group
2008-11-09 17:18 –d—– c:\program files\Exterminate It!
2008-11-08 12:47 516,096 ——– c:\windows\system32\ati2sgag.exe
2008-11-08 12:28 –d—– c:\program files\ATI Technologies
2008-11-08 00:53 –d—– C:\ATI
2008-11-07 23:45 265,600 a——- c:\windows\system32\drivers\APPFCONT.DAT.bck
2008-11-07 23:45 265,600 a——- c:\windows\system32\drivers\APPFCONT.DAT
2008-11-07 23:45 1,132 a——- c:\windows\system32\drivers\APPFLTR.CFG.bck
2008-11-07 23:45 1,132 a——- c:\windows\system32\drivers\APPFLTR.CFG
2008-11-07 23:45 193,792 a——- c:\windows\system32\drivers\idsflt.sys
2008-11-07 23:45 52,992 a——- c:\windows\system32\drivers\dsaflt.sys
2008-11-07 23:45 46,720 a——- c:\windows\system32\drivers\wnmflt.sys
2008-11-07 23:45 73,728 a——- c:\windows\system32\drivers\APPFLT.SYS
2008-11-07 23:45 22,072 a——- c:\windows\system32\drivers\fnetmon.sys
2008-11-07 23:45 158,848 a——- c:\windows\system32\drivers\NETFLTDI.SYS
2008-11-07 23:16 8,627 a——- c:\windows\system32\PAV_FOG.OPC
2008-11-07 23:10 13,880 a——- c:\windows\system32\drivers\COMFiltr.sys
2008-11-07 23:09 84,024 a——- c:\windows\system32\drivers\pavdrv51.sys
2008-11-07 23:09 249 a——- c:\windows\system32\PavCPL.dat
2008-11-07 23:08 54,832 a——- c:\windows\system32\pavcpl.cpl
2008-11-07 23:08 446,464 a——- c:\windows\system32\HHActiveX.dll
2008-11-07 23:08 193,280 a——- c:\windows\system32\TpUtil.dll
2008-11-07 23:08 107,568 a——- c:\windows\system32\SYSTOOLS.DLL
2008-11-07 23:08 520,448 a——- c:\windows\system32\PavSHook.dll
2008-11-07 23:08 197,888 a——- c:\windows\system32\drivers\neti1634.sys
2008-11-07 23:08 87,296 a——- c:\windows\system32\PavLspHook.dll
2008-11-07 23:08 55,552 a——- c:\windows\system32\pavipc.dll
2008-11-07 23:08 58,672 a——- c:\windows\system32\avldr.dll
2008-11-07 23:08 –d—– c:\windows\system32\PAV
2008-11-07 23:08 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Panda Security
2008-11-07 23:08 –d—– c:\docume~1\alluse~1\applic~1\Panda Security
2008-11-07 23:05 179,640 a——- c:\windows\system32\drivers\PavProc.sys
2008-11-07 23:05 41,144 a——- c:\windows\system32\drivers\ShlDrv51.sys
2008-11-07 22:58 –d—– c:\program files\common files\Panda Security
2008-11-07 13:32 28,544 a——- c:\windows\system32\drivers\pavboot.sys
2008-11-07 13:32 –d—– c:\program files\Panda Security
2008-11-07 13:24 –d—– c:\program files\Trend Micro
2008-11-07 11:55 –d-h— c:\windows\system32\GroupPolicy
2008-11-06 15:39 19,188 a——- c:\windows\Q883956Readme.rtf
2008-11-06 12:29 664 a——- c:\windows\system32\d3d9caps.dat
2008-11-06 11:09 552 a——- c:\windows\system32\d3d8caps.dat
2008-11-06 10:16 1,851,546 a——- c:\windows\system32\gdql_lsa.dll
2008-11-06 10:16 683,150 a——- c:\windows\system32\qdiaglsa.ocx
2008-11-06 10:16 29,184 a——- c:\windows\system32\drivers\goprot51.sys
2008-11-06 10:16 208,896 a——- c:\windows\system32\GTDownLS_125.ocx
2008-11-06 10:16 135,168 a——- c:\windows\system32\GoProto.dll
2008-11-06 10:16 6,977 a——- c:\windows\system32\DDMI2.sys
2008-11-06 10:16 6,656 a——- c:\windows\system32\DLPT2.sys
2008-11-05 23:46 –d—– c:\program files\FMS
2008-11-05 23:22 –d-h— c:\windows\msdownld.tmp
2008-11-05 23:22 –d—– c:\windows\Logs
2008-11-05 21:00 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\WildTangent
2008-11-05 21:00 –d-h— c:\docume~1\alluse~1\applic~1\WildTangent
2008-11-05 20:20 –d—– c:\program files\Transcendental Technologies
2008-11-04 23:39 –d—– c:\program files\SVKSystems
2008-11-04 16:13 10,368 a——- c:\windows\system32\drivers\hidusb.sys
2008-11-04 16:13 10,368 a——- c:\windows\system32\dllcache\hidusb.sys
2008-11-04 16:10 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Vso
2008-11-01 08:24 –d—– c:\program files\SiteAdvisor
2008-11-01 08:10 –d—– c:\windows\system32\kodak
2008-11-01 02:12 272,128 ——– c:\windows\system32\dllcache\bthport.sys
2008-11-01 02:12 138,496 ——– c:\windows\system32\dllcache\afd.sys
2008-11-01 02:11 333,824 ——– c:\windows\system32\dllcache\srv.sys
2008-11-01 02:11 1,846,400 ——– c:\windows\system32\dllcache\win32k.sys
2008-11-01 02:11 203,136 ——– c:\windows\system32\dllcache\rmcast.sys
2008-11-01 02:11 331,776 ——– c:\windows\system32\dllcache\msadce.dll
2008-11-01 02:11 691,712 ——– c:\windows\system32\dllcache\inetcomm.dll
2008-11-01 02:10 337,408 ——– c:\windows\system32\dllcache\netapi32.dll
2008-11-01 01:44 –d—– c:\windows\system32\scripting
2008-11-01 01:44 –d—– c:\windows\system32\en
2008-11-01 01:44 –d—– c:\windows\system32\bits
2008-11-01 01:21 67,866 ——– c:\windows\system32\drivers\netwlan5.img
2008-10-31 22:54 –d—– c:\windows\system32\PreInstall
2008-10-31 22:51 33,992 a——- c:\windows\system32\wucltui.dll.mui
2008-10-31 22:51 25,800 a——- c:\windows\system32\wuaucpl.cpl.mui
2008-10-31 22:51 20,680 a——- c:\windows\system32\wuaueng.dll.mui
2008-10-31 22:51 25,800 a——- c:\windows\system32\wuapi.dll.mui
2008-10-31 22:51 –d—– c:\windows\system32\SoftwareDistribution
2008-10-31 21:38 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Ascentive
2008-10-31 08:18 –d—– c:\program files\Microsoft Picture It! 7
2008-10-31 05:06 36,864 a——- c:\windows\system32\ascbalon.dll
2008-10-31 01:43 –d-h— c:\docume~1\alluse~1\applic~1\Ascentive
2008-10-31 01:29 12,800 a——- c:\windows\system32\EKDeviceServices.dll
2008-10-31 01:28 335,872 a——- c:\windows\system32\EKIJ5000MON.dll
2008-10-31 01:22 1,563 a——- c:\windows\system32\InstallUtil.InstallLog
2008-10-31 01:20 87,040 a——- c:\windows\system32\wiafbdrv.dll
2008-10-31 01:20 87,040 a——- c:\windows\system32\dllcache\wiafbdrv.dll
2008-10-31 00:38 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Skinux
2008-10-30 23:09 –dsh— c:\documents and settings\hp_administrator.mrwoffice\UserData
2008-10-30 22:14 –d—– C:\SystemRoot
2008-10-30 22:12 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\WinBatch
2008-10-30 22:12 –d—– C:\temp
2008-10-30 21:40 626,960 a—-r– c:\windows\system32\hpvaut32.dll
2008-10-30 21:40 487,424 a—-r– c:\windows\system32\hpvcp70.dll
2008-10-30 21:40 344,064 a—-r– c:\windows\system32\hpvcr70.dll
2008-10-29 23:23 5,632 a——- c:\windows\system32\ptpusb.dll
2008-10-29 23:23 159,232 a——- c:\windows\system32\ptpusd.dll
2008-10-29 23:23 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2008-10-29 23:23 15,104 a——- c:\windows\system32\dllcache\usbscan.sys
2008-10-29 23:10 25,856 a——- c:\windows\system32\drivers\usbprint.sys
2008-10-29 23:10 32,128 a——- c:\windows\system32\drivers\usbccgp.sys
2008-10-29 23:07 303,104 a——- c:\windows\system32\ciplListBar.ocx
2008-10-29 23:07 224,016 a——- c:\windows\system32\tabctl32.ocx
2008-10-29 23:07 155,648 a——- c:\windows\system32\ciplImageList.ocx
2008-10-29 21:04 –d—– c:\windows\system32\LogFiles
2008-10-29 20:53 10,671 a——- c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-29 20:53 805 a——- c:\windows\system32\drivers\SYMEVENT.INF
2008-10-29 18:23 –d—– C:\MSXML3msms
2008-10-29 17:08 3,676 a——- c:\windows\system32\OEMINFO.PNF
2008-10-29 17:06 –d—– c:\windows\system32\appmgmt
2008-10-29 16:55 –d—– c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2008-10-29 16:49 –dshr– c:\windows\system32\dllcache
2008-10-29 16:24 73,728 a——- c:\windows\system32\javacpl.cpl
2008-10-29 15:54 –dshr– C:\cmdcons
2008-10-29 15:54 –d—– c:\windows\setupupd
2008-10-29 15:49 1,845 a–shr– c:\windows\system32\drivers\103C_HP_CPC_ER888AA-ABA A1267C_YC_0Pavi_QMXK614_E62NAemMPA1_48_IAMETHYST-M_SMSI_V1.0_B3.47_T060303_WXP2_L409_M959_J200_7AMD_8Athlon 64_92.39_#060421_N10EC8139_Z11C1048C_G10025954.MRK
2008-10-29 15:44 2,145,280 a——- c:\windows\system32\ntoskrnl.exe
2008-10-29 15:44 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\Intuit
2008-10-29 15:44 –d—– c:\docume~1\hp_adm~1.mrw\applic~1\HPQ
2008-10-29 15:44 –d—– c:\documents and settings\hp_administrator.mrwoffice\WINDOWS
2008-10-29 15:44 –d—– c:\documents and settings\HP_Administrator.MRWOFFICE
2008-10-28 09:15 –d—– c:\program files\MarketBrowser
2008-10-23 20:38 54,156 a—h— c:\windows\QTFont.qfn
2008-10-23 20:38 1,409 a——- c:\windows\QTFont.for

==================== Find3M ====================

2008-11-09 18:13 –d—– c:\program files\WildTangent
2008-11-07 10:04 –d—– c:\program files\common files\Real
2008-11-06 10:16 –d—– c:\program files\Linksys EasyLink Advisor
2008-11-01 08:05 –d—– c:\program files\common files\Symantec Shared
2008-11-01 08:05 –d—– c:\program files\Norton SystemWorks
2008-11-01 07:32 –d-h— c:\docume~1\alluse~1\applic~1\Symantec
2008-11-01 05:45 –d—– c:\program files\Messenger
2008-11-01 01:50 92,947 a——- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-11-01 01:44 –d—– c:\program files\Windows NT
2008-10-31 01:19 –d—– c:\program files\Kodak
2008-10-31 01:17 –d-h— c:\docume~1\alluse~1\applic~1\Kodak
2008-10-30 22:04 139,264 a——- c:\windows\system32\hpzjrd01.dll
2008-10-30 22:03 94,259 a——- c:\windows\HPHins03.dat
2008-10-29 17:05 –d—– c:\program files\Quicken
2008-10-29 16:41 –d—– c:\program files\PC-Doctor 5 for Windows
2008-10-09 12:05 –d—– c:\program files\INITIO
2008-10-04 18:20 –d—– c:\program files\InterVideo
2008-10-03 11:41 6,066,176 ——– c:\windows\system32\dllcache\ieframe.dll
2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll
2008-09-15 06:12 1,846,400 a——- c:\windows\system32\win32k.sys
2008-09-09 19:14 1,307,648 ——– c:\windows\system32\msxml6.dll
2008-09-09 19:14 1,307,648 ——– c:\windows\system32\dllcache\msxml6.dll
2008-09-04 11:15 1,106,944 a——- c:\windows\system32\msxml3.dll
2008-08-27 02:24 3,593,216 a——- c:\windows\system32\dllcache\mshtml.dll
2008-08-25 02:38 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 02:37 70,656 a——- c:\windows\system32\dllcache\ie4uinit.exe
2008-08-22 23:56 635,848 a——- c:\windows\system32\dllcache\iexplore.exe
2008-08-22 23:54 161,792 a——- c:\windows\system32\dllcache\ieakui.dll
2008-04-03 07:20 –d-h— c:\docume~1\alluse~1\applic~1\FaxCtr
2007-09-10 11:50 –d-h— c:\docume~1\alluse~1\applic~1\vsosdk
2007-06-11 21:44 –d-h— c:\docume~1\alluse~1\applic~1\BVRP Software
2007-04-21 07:16 –d—– c:\docume~1\alluse~1\applic~1\Windows Live Toolbar
2007-03-02 12:12 –d-h— c:\docume~1\alluse~1\applic~1\Viewpoint
2007-02-27 11:29 –d-h— c:\docume~1\alluse~1\applic~1\Cadsoft
2006-10-23 17:44 –d-h— c:\docume~1\alluse~1\applic~1\Pure Networks
2006-03-07 12:55 –d-h— c:\docume~1\alluse~1\applic~1\Intuit
2006-03-07 12:40 –d-h— c:\docume~1\alluse~1\applic~1\Digital Interactive Systems Corporation
2006-03-07 12:21 –d-h— c:\docume~1\alluse~1\applic~1\SBSI
2007-03-06 19:32 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012007030620070307\index.dat
2007-06-23 17:29 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012007062320070624\index.dat
2007-06-26 20:23 32,768 ac-sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012007062620070627\index.dat

============= FINISH: 15:11:24.64 ===============

MRW1

Post #12November 14, 2008, 9:29 PM UTC

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Version 1.0) Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 10/29/2008 4:42:43 PM System Uptime: 11/14/2008 11:45:43 AM (4 hours ago) Motherboard: MSI | | AMETHYST-M Processor: AMD Athlon™ 64 Processor 3800+ | Socket 939 | 2387/200mhz BIOS: Phoenix - Award BIOS v6.00PG | HP-CPC - 42302e31 | 3.47 | 3/2/2006 6:00:00 PM ==== Disk Partitions ========================= C: is FIXED (NTFS) - 178 GiB total, 67.434 GiB free. D: is FIXED (FAT32) - 8 GiB total, 0.402 GiB free. E: is CDROM () F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 11/13/2008 10:05:18 PM - System Checkpoint RP2: 11/13/2008 10:05:43 PM - ComboFix created restore point ==== Installed Programs ====================== 5 Card Slingo from HP Media Center (remove only) Acrobat.com ActiveSpeed Adobe AIR Adobe Flash Player 10 Plugin AiO_Scan AiO_Scan_CDA aiofw aioocr aioprnt AiOSoftware AiOSoftwareNPI AstroPop Deluxe from HP Media Center (remove only) ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver Bejeweled 2 Deluxe from HP Media Center (remove only) Blackhawk Striker 2 from HP Media Center (remove only) Blasterball 2 from HP Media Center (remove only) Blasterball 2 Remix from HP Media Center (remove only) Boggle Supreme from HP Media Center (remove only) Bookworm Deluxe from HP Media Center (remove only) Bounce Symphony from HP Media Center (remove only) BufferChm CameraDrivers center Chuzzle Deluxe from HP Media Center (remove only) ClearView CP_AtenaShokunin1Config CP_CalendarTemplates1 cp_LightScribeConfig cp_OnlineProjectsConfig CP_Package_Basic1 CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 CP_Panorama1Config cp_PosterPrintConfig cp_UpdateProjectsConfig CreativeProjects CreativeProjectsTemplates Crystal Maze from HP Media Center (remove only) CueTour Customer Experience Enhancement Destinations DISCover DocProc DocumentViewer DocumentViewerQFolder Easy Internet Sign-up Enhanced Multimedia Keyboard Solution ERUNT 1.1j Family Feud FATE from HP Media Center (remove only) Fax Fax_CDA FMS FullDPAppQFolder GemMaster Mystic Google Toolbar for Internet Explorer Help_CTR helptut helpug High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Windows Media Player 10 (KB910393) Hotfix for Windows XP (KB952287) HP Boot Optimizer HP Deskjet Printer Preload HP DigitalMedia Archive HP Document Viewer 5.3 HP DVD Play 1.0 HP Game Console and games HP Imaging Device Functions 6.0 HP Photosmart 330,380,420,470,7800,8000,8200 Series HP Photosmart Cameras 5.0 HP Photosmart for Media Center PC HP Photosmart Premier Software 6.0 HP PSC & OfficeJet 5.3.A HP PSC & OfficeJet 5.3.B HP Rhapsody HP Software Update HP Solution Center & Imaging Support Tools 5.3 HP Update HP Web Helper HPProductAssistant HpSdpAppCoreApp HPSystemDiagnostics Insaniquarium Deluxe from HP Media Center (remove only) InstantShare InstantShareDevices J2SE Runtime Environment 5.0 Update 5 Java™ 6 Update 7 ksdip Lemonade Tycoon 2 from HP Media Center (remove only) Lexibox Deluxe from HP Media Center (remove only) LightScribe 1.4.62.1 Linksys EasyLink Advisor 1.5 (1010) Macromedia Flash Player 8 Mah Jong Quest from HP Media Center (remove only) Malwarebytes' Anti-Malware Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Away Mode Microsoft Digital Image Pro 7.0 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Money 2006 Microsoft National Language Support Downlevel APIs Microsoft Office Professional Edition 2003 Microsoft Office Project Professional 2003 Microsoft Office Visio Professional 2003 Microsoft Visual C++ 2005 Redistributable Microsoft Works Microsoft XML Parser Mozilla Firefox (2.0.0.18) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) muvee autoProducer 4.5 muvee autoProducer unPlugged 1.2 netbrdg Netscape Browser (remove only) NewCopy NewCopy_CDA OptionalContentQFolder Otto Overland Panda ActiveScan 2.0 Panda Antivirus Pro 2009 PanoStandAlone PC-Doctor 5 for Windows PC SpeedScan Pro Performance Center PhotoGallery Photosmart 320,370,7400,8100,8400 Series Polar Bowler from HP Media Center (remove only) Polar Golfer from HP Media Center (remove only) PrintScreen PS2 PS7400 PSPrinters06 PSPrinters08 PSTAPlugin Python 2.2 pywin32 extensions (build 203) Python 2.2.3 QuickProjects RandMap Readme Remove IntelliMover Demo Scan ScannerCopy SCRABBLE from HP Media Center (remove only) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Shooting Stars Pool from HP Media Center (remove only) Shrek 2 Ogre Bowler from HP Media Center (remove only) SkinsHP1 Slingo Deluxe from HP Media Center (remove only) SolutionCenter Sonic Express Labeler Sonic MyDVD Plus Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager Sonic_PrimoSDK SpyHunter Status Tradewinds from HP Media Center (remove only) TrayApp Unload Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Updates from HP (remove only) WebFldrs XP WebReg Windows Imaging Component Windows Media Format Runtime Windows XP Media Center Edition 2005 KB908250 Windows XP Service Pack 3 Zuma Deluxe from HP Media Center (remove only) ==== Event Viewer Messages =================== 11/8/2008 12:00:00 PM, error: Schedule [7901] - The At37.job command failed to start due to the following error: %%2147942402 11/8/2008 12:00:00 PM, error: Schedule [7901] - The At13.job command failed to start due to the following error: %%2147942402 11/8/2008 11:00:00 AM, error: Schedule [7901] - The At36.job command failed to start due to the following error: %%2147942402 11/8/2008 11:00:00 AM, error: Schedule [7901] - The At12.job command failed to start due to the following error: %%2147942402 11/8/2008 10:00:00 AM, error: Schedule [7901] - The At35.job command failed to start due to the following error: %%2147942402 11/8/2008 10:00:00 AM, error: Schedule [7901] - The At11.job command failed to start due to the following error: %%2147942402 11/8/2008 9:28:56 AM, error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration. 11/8/2008 9:28:49 AM, error: Service Control Manager [7000] - The Kodak Camera Connection Software service failed to start due to the following error: The system cannot find the file specified. 11/8/2008 9:28:36 AM, error: Service Control Manager [7000] - The Kodak AiO Device Service service failed to start due to the following error: The system cannot find the path specified. 11/8/2008 9:17:43 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ftsata2 11/8/2008 9:14:09 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334} 11/8/2008 9:00:00 AM, error: Schedule [7901] - The At34.job command failed to start due to the following error: %%2147942402 11/8/2008 9:00:00 AM, error: Schedule [7901] - The At10.job command failed to start due to the following error: %%2147942402 11/8/2008 8:00:00 AM, error: Schedule [7901] - The At9.job command failed to start due to the following error: %%2147942402 11/8/2008 8:00:00 AM, error: Schedule [7901] - The At33.job command failed to start due to the following error: %%2147942402 11/8/2008 7:00:00 AM, error: Schedule [7901] - The At8.job command failed to start due to the following error: %%2147942402 11/8/2008 7:00:00 AM, error: Schedule [7901] - The At32.job command failed to start due to the following error: %%2147942402 11/8/2008 6:00:00 AM, error: Schedule [7901] - The At7.job command failed to start due to the following error: %%2147942402 11/8/2008 6:00:00 AM, error: Schedule [7901] - The At31.job command failed to start due to the following error: %%2147942402 11/8/2008 5:00:00 AM, error: Schedule [7901] - The At6.job command failed to start due to the following error: %%2147942402 11/8/2008 5:00:00 AM, error: Schedule [7901] - The At30.job command failed to start due to the following error: %%2147942402 11/8/2008 4:00:00 AM, error: Schedule [7901] - The At5.job command failed to start due to the following error: %%2147942402 11/8/2008 4:00:00 AM, error: Schedule [7901] - The At29.job command failed to start due to the following error: %%2147942402 11/8/2008 12:10:00 AM, error: Schedule [7901] - The At25.job command failed to start due to the following error: %%2147942402 11/8/2008 12:08:00 AM, error: Schedule [7901] - The At1.job command failed to start due to the following error: %%2147942402 11/7/2008 11:00:00 PM, error: Schedule [7901] - The At48.job command failed to start due to the following error: %%2147942402 11/7/2008 11:00:00 PM, error: Schedule [7901] - The At24.job command failed to start due to the following error: %%2147942402 11/7/2008 10:00:00 PM, error: Schedule [7901] - The At47.job command failed to start due to the following error: %%2147942402 11/7/2008 10:00:00 PM, error: Schedule [7901] - The At23.job command failed to start due to the following error: %%2147942402 11/7/2008 9:00:00 PM, error: Schedule [7901] - The At46.job command failed to start due to the following error: %%2147942402 11/7/2008 9:00:00 PM, error: Schedule [7901] - The At22.job command failed to start due to the following error: %%2147942402 11/7/2008 8:00:00 PM, error: Schedule [7901] - The At45.job command failed to start due to the following error: %%2147942402 11/7/2008 8:00:00 PM, error: Schedule [7901] - The At21.job command failed to start due to the following error: %%2147942402 11/7/2008 7:00:01 PM, error: Schedule [7901] - The At44.job command failed to start due to the following error: %%2147942402 11/7/2008 7:00:01 PM, error: Schedule [7901] - The At20.job command failed to start due to the following error: %%2147942402 11/7/2008 6:00:00 PM, error: Schedule [7901] - The At43.job command failed to start due to the following error: %%2147942402 11/7/2008 6:00:00 PM, error: Schedule [7901] - The At19.job command failed to start due to the following error: %%2147942402 11/7/2008 5:00:00 PM, error: Schedule [7901] - The At42.job command failed to start due to the following error: %%2147942402 11/7/2008 5:00:00 PM, error: Schedule [7901] - The At18.job command failed to start due to the following error: %%2147942402 11/7/2008 4:43:12 PM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service McNASvc with arguments "" in order to run the server: {24F616A1-B755-4053-8018-C3425DC8B68A} 11/7/2008 4:00:00 PM, error: Schedule [7901] - The At41.job command failed to start due to the following error: %%2147942402 11/7/2008 3:00:00 PM, error: Schedule [7901] - The At40.job command failed to start due to the following error: %%2147942402 11/7/2008 2:00:00 PM, error: Schedule [7901] - The At39.job command failed to start due to the following error: %%2147942402 11/7/2008 1:00:00 PM, error: Schedule [7901] - The At38.job command failed to start due to the following error: %%2147942402 11/7/2008 11:40:00 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097} 11/7/2008 3:00:00 AM, error: Schedule [7901] - The At28.job command failed to start due to the following error: %%2147942402 11/7/2008 2:00:00 AM, error: Schedule [7901] - The At27.job command failed to start due to the following error: %%2147942402 11/7/2008 1:00:00 AM, error: Schedule [7901] - The At26.job command failed to start due to the following error: %%2147942402 11/8/2008 1:00:00 PM, error: Schedule [7901] - The At14.job command failed to start due to the following error: %%2147942402 11/8/2008 2:00:00 PM, error: Schedule [7901] - The At15.job command failed to start due to the following error: %%2147942402 11/8/2008 3:00:00 PM, error: Schedule [7901] - The At16.job command failed to start due to the following error: %%2147942402 11/8/2008 4:00:00 PM, error: Schedule [7901] - The At17.job command failed to start due to the following error: %%2147942402 11/10/2008 7:02:32 AM, error: Service Control Manager [7000] - The Kodak Camera Connection Software service failed to start due to the following error: The system cannot find the path specified. 11/14/2008 1:59:41 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 11/8/2008 8:59:51 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\atrace.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.0. 11/8/2008 8:59:51 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ativtmxx.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 8:59:51 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ativmvxx.ax. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 8:59:51 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ativdaxx.ax. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 8:59:51 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ati3d1ag.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.4071. 11/8/2008 8:59:50 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ati2dvaa.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.13.10.5019. 11/8/2008 8:59:50 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\drivers\ati2mtag.sys. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6571. 11/8/2008 12:35:19 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ativtmxx.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 12:35:19 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ativmvxx.ax. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 12:35:19 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ativdaxx.ax. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.6238. 11/8/2008 12:35:19 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ati3d1ag.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.14.10.4071. 11/8/2008 12:35:19 AM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file ati2dvaa.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 6.13.10.5019. ==== End Of File ===========================

little eagle

Post #13November 15, 2008, 4:19 PM UTC

Open notepad and copy/paste the text in the codebox below into it:

File::
c:\windows\system32\7dfxYxG7.exe
c:\windows\system32\V032CCNE.exe

Save this as Save this as "CFScript"

[external image: Posted Image]

Referring to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

You can also delete the task like this one >>>> c:\windows\Tasks\At9.job

MRW1

Post #14November 15, 2008, 7:29 PM UTC

ComboFix 08-11-12.01 - HP_Administrator 2008-11-15 13:03:50.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.482 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Administrator.MRWOFFICE\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\system32\7dfxYxG7.exe
c:\windows\system32\V032CCNE.exe
.

((((((((((((((((((((((((( Files Created from 2008-10-15 to 2008-11-15 )))))))))))))))))))))))))))))))
.

2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\program files\Malwarebytes' Anti-Malware
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-11-13 11:59 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-13 11:59 . 2008-10-22 16:10 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-13 11:59 . 2008-10-22 16:10 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2008-11-13 11:54 . 2008-11-13 11:54 d——– c:\program files\ERUNT
2008-11-12 12:02 . 2008-09-04 11:15 1,106,944 ——— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:02 . 2008-10-24 05:21 455,296 ——— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-11 00:46 . 2008-11-11 00:46 d——– c:\program files\Common Files\Adobe AIR
2008-11-10 15:18 . 2008-11-10 15:18 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-11-09 17:47 . 2008-11-09 17:47 d——– c:\program files\Enigma Software Group
2008-11-09 17:18 . 2008-11-09 17:41 d——– c:\program files\Exterminate It!
2008-11-08 12:47 . 2005-08-13 21:05 516,096 ——— c:\windows\system32\ati2sgag.exe
2008-11-08 12:28 . 2008-11-08 12:48 d——– c:\program files\ATI Technologies
2008-11-08 00:53 . 2008-11-08 00:53 d——– C:\ATI
2008-11-07 23:45 . 2008-11-14 10:21 265,600 –a—— c:\windows\system32\drivers\APPFCONT.DAT.bck
2008-11-07 23:45 . 2008-11-14 10:21 265,600 –a—— c:\windows\system32\drivers\APPFCONT.DAT
2008-11-07 23:45 . 2008-06-18 16:06 193,792 –a—— c:\windows\system32\drivers\idsflt.sys
2008-11-07 23:45 . 2008-07-11 14:58 158,848 –a—— c:\windows\system32\drivers\NETFLTDI.SYS
2008-11-07 23:45 . 2008-06-25 15:42 73,728 –a—— c:\windows\system32\drivers\APPFLT.SYS
2008-11-07 23:45 . 2008-06-18 16:06 52,992 –a—— c:\windows\system32\drivers\dsaflt.sys
2008-11-07 23:45 . 2008-06-18 16:06 46,720 –a—— c:\windows\system32\drivers\wnmflt.sys
2008-11-07 23:45 . 2008-03-28 11:25 22,072 –a—— c:\windows\system32\drivers\fnetmon.sys
2008-11-07 23:45 . 2008-11-14 15:56 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG.bck
2008-11-07 23:45 . 2008-11-14 15:56 1,132 –a—— c:\windows\system32\drivers\APPFLTR.CFG
2008-11-07 23:16 . 2008-11-15 08:05 8,627 –a—— c:\windows\system32\PAV_FOG.OPC
2008-11-07 23:10 . 2008-11-14 15:56 13,880 –a—— c:\windows\system32\drivers\COMFiltr.sys
2008-11-07 23:09 . 2008-04-28 17:35 84,024 –a—— c:\windows\system32\drivers\pavdrv51.sys
2008-11-07 23:09 . 2008-11-07 23:09 249 –a—— c:\windows\system32\PavCPL.dat
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\windows\system32\PAV
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Panda Security
2008-11-07 23:08 . 2008-11-07 23:08 d——– c:\documents and settings\All Users\Application Data\Panda Security
2008-11-07 23:08 . 2008-06-18 18:03 520,448 –a—— c:\windows\system32\PavSHook.dll
2008-11-07 23:08 . 2003-10-22 18:23 446,464 –a—— c:\windows\system32\HHActiveX.dll
2008-11-07 23:08 . 2008-06-26 11:25 197,888 –a—— c:\windows\system32\drivers\neti1634.sys
2008-11-07 23:08 . 2008-06-24 14:48 193,280 –a—— c:\windows\system32\TpUtil.dll
2008-11-07 23:08 . 2007-02-08 11:53 107,568 –a—— c:\windows\system32\SYSTOOLS.DLL
2008-11-07 23:08 . 2008-06-18 18:03 87,296 –a—— c:\windows\system32\PavLspHook.dll
2008-11-07 23:08 . 2008-03-18 16:58 58,672 –a—— c:\windows\system32\avldr.dll
2008-11-07 23:08 . 2008-06-18 18:03 55,552 –a—— c:\windows\system32\pavipc.dll
2008-11-07 23:08 . 2007-03-15 19:38 54,832 –a—— c:\windows\system32\pavcpl.cpl
2008-11-07 23:05 . 2008-02-07 12:03 179,640 –a—— c:\windows\system32\drivers\PavProc.sys
2008-11-07 23:05 . 2008-03-04 15:59 41,144 –a—— c:\windows\system32\drivers\ShlDrv51.sys
2008-11-07 22:58 . 2008-11-07 22:58 d——– c:\program files\Common Files\Panda Security
2008-11-07 13:32 . 2008-11-07 23:08 d——– c:\program files\Panda Security
2008-11-07 13:32 . 2008-06-19 17:24 28,544 –a—— c:\windows\system32\drivers\pavboot.sys
2008-11-07 13:24 . 2008-11-07 13:24 d——– c:\program files\Trend Micro
2008-11-07 11:55 . 2008-11-07 11:55 d–h—– c:\windows\system32\GroupPolicy
2008-11-06 16:14 . 2008-11-06 16:14 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\ATI
2008-11-06 15:39 . 2004-02-24 16:25 19,188 –a—— c:\windows\Q883956Readme.rtf
2008-11-06 12:29 . 2008-11-06 12:30 664 –a—— c:\windows\system32\d3d9caps.dat
2008-11-06 11:09 . 2008-11-06 11:09 552 –a—— c:\windows\system32\d3d8caps.dat
2008-11-06 10:16 . 2006-04-02 16:52 1,851,546 –a—— c:\windows\system32\gdql_lsa.dll
2008-11-06 10:16 . 2006-01-16 22:08 683,150 –a—— c:\windows\system32\qdiaglsa.ocx
2008-11-06 10:16 . 2005-08-30 12:23 208,896 –a—— c:\windows\system32\GTDownLS_125.ocx
2008-11-06 10:16 . 2005-11-21 13:17 135,168 –a—— c:\windows\system32\GoProto.dll
2008-11-06 10:16 . 2008-11-06 10:16 29,184 –a—— c:\windows\system32\drivers\goprot51.sys
2008-11-06 10:16 . 2004-06-09 09:29 6,977 –a—— c:\windows\system32\DDMI2.sys
2008-11-06 10:16 . 2005-03-13 16:54 6,656 –a—— c:\windows\system32\DLPT2.sys
2008-11-05 23:46 . 2008-11-05 23:47 d——– c:\program files\FMS
2008-11-05 23:22 . 2008-11-06 10:04 d–h—– c:\windows\msdownld.tmp
2008-11-05 23:22 . 2008-11-05 23:22 d——– c:\windows\Logs
2008-11-05 21:00 . 2008-11-05 21:00 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WildTangent
2008-11-05 21:00 . 2008-11-05 21:00 d–h—– c:\documents and settings\All Users\Application Data\WildTangent
2008-11-05 20:20 . 2008-11-05 20:20 d——– c:\program files\Transcendental Technologies
2008-11-04 23:39 . 2008-11-04 23:39 d——– c:\program files\SVKSystems
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\drivers\hidusb.sys
2008-11-04 16:13 . 2008-04-13 12:45 10,368 –a—— c:\windows\system32\dllcache\hidusb.sys
2008-11-04 16:10 . 2008-11-14 14:00 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Vso
2008-11-01 09:58 . 2008-11-07 08:35 d——– c:\documents and settings\LocalService\Application Data\SACore
2008-11-01 08:25 . 2008-11-01 08:25 d–h—– c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-11-01 08:24 . 2008-11-01 08:24 d——– c:\program files\SiteAdvisor
2008-11-01 08:12 . 2008-11-07 23:36 d–h—– c:\documents and settings\All Users\Application Data\McAfee
2008-11-01 08:10 . 2008-11-01 08:10 d——– c:\windows\system32\kodak
2008-11-01 02:12 . 2008-06-13 05:05 272,128 ——— c:\windows\system32\dllcache\bthport.sys
2008-11-01 02:12 . 2008-08-14 04:04 138,496 ——— c:\windows\system32\dllcache\afd.sys
2008-11-01 02:11 . 2008-09-15 06:12 1,846,400 ——— c:\windows\system32\dllcache\win32k.sys
2008-11-01 02:11 . 2008-04-11 13:04 691,712 ——— c:\windows\system32\dllcache\inetcomm.dll
2008-11-01 02:11 . 2008-09-08 04:41 333,824 ——— c:\windows\system32\dllcache\srv.sys
2008-11-01 02:11 . 2008-05-01 08:33 331,776 ——— c:\windows\system32\dllcache\msadce.dll
2008-11-01 02:11 . 2008-05-08 08:02 203,136 ——— c:\windows\system32\dllcache\rmcast.sys
2008-11-01 02:10 . 2008-10-15 10:34 337,408 ——— c:\windows\system32\dllcache\netapi32.dll
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\scripting
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\en
2008-11-01 01:44 . 2008-11-01 01:44 d——– c:\windows\system32\bits
2008-11-01 01:21 . 2008-04-13 18:12 1,737,856 ——— c:\windows\system32\mtxparhd.dll
2008-10-31 22:51 . 2008-07-18 22:10 45,768 –a—— c:\windows\system32\wups2.dll
2008-10-31 22:51 . 2008-07-18 22:10 33,992 –a—— c:\windows\system32\wucltui.dll.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuaucpl.cpl.mui
2008-10-31 22:51 . 2008-07-18 22:09 25,800 –a—— c:\windows\system32\wuapi.dll.mui
2008-10-31 22:51 . 2008-07-18 22:08 20,680 –a—— c:\windows\system32\wuaueng.dll.mui
2008-10-31 21:38 . 2008-10-31 21:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Ascentive
2008-10-31 08:18 . 2008-10-31 08:21 d——– c:\program files\Microsoft Picture It! 7
2008-10-31 05:06 . 2007-07-03 11:48 36,864 –a—— c:\windows\system32\ascbalon.dll
2008-10-31 02:34 . 2008-10-31 02:34 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\AdobeUM
2008-10-31 01:43 . 2008-10-31 01:43 d–h—– c:\documents and settings\All Users\Application Data\Ascentive
2008-10-31 01:29 . 2008-02-28 17:57 12,800 –a—— c:\windows\system32\EKDeviceServices.dll
2008-10-31 01:28 . 2008-02-15 06:03 335,872 –a—— c:\windows\system32\EKIJ5000MON.dll
2008-10-31 01:22 . 2008-10-31 01:30 1,563 –a—— c:\windows\system32\InstallUtil.InstallLog
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\wiafbdrv.dll
2008-10-31 01:20 . 2001-08-17 21:36 87,040 –a—— c:\windows\system32\dllcache\wiafbdrv.dll
2008-10-31 00:38 . 2008-10-31 00:38 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\Skinux
2008-10-31 00:33 . 2008-10-31 01:36 d—-c— c:\windows\system32\DRVSTORE
2008-10-30 23:09 . 2008-10-30 23:09 d–hs—- c:\documents and settings\HP_Administrator.MRWOFFICE\UserData
2008-10-30 22:14 . 2008-10-30 22:14 d——– C:\SystemRoot
2008-10-30 22:12 . 2008-10-30 22:12 d——– C:\temp
2008-10-30 22:12 . 2008-10-30 22:12 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\WinBatch
2008-10-30 21:40 . 2004-05-11 09:53 626,960 -ra—— c:\windows\system32\hpvaut32.dll
2008-10-30 21:40 . 2004-05-11 09:53 487,424 -ra—— c:\windows\system32\hpvcp70.dll
2008-10-30 21:40 . 2004-05-11 09:53 344,064 -ra—— c:\windows\system32\hpvcr70.dll
2008-10-29 23:23 . 2004-08-04 00:56 159,232 –a—— c:\windows\system32\ptpusd.dll
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\drivers\usbscan.sys
2008-10-29 23:23 . 2008-04-13 11:45 15,104 –a—— c:\windows\system32\dllcache\usbscan.sys
2008-10-29 23:23 . 2001-08-17 22:36 5,632 –a—— c:\windows\system32\ptpusb.dll
2008-10-29 23:10 . 2008-04-13 12:45 32,128 –a—— c:\windows\system32\drivers\usbccgp.sys
2008-10-29 23:10 . 2008-04-13 12:47 25,856 –a—— c:\windows\system32\drivers\usbprint.sys
2008-10-29 23:07 . 2007-08-10 12:56 303,104 –a—— c:\windows\system32\ciplListBar.ocx
2008-10-29 23:07 . 2007-08-10 12:56 224,016 –a—— c:\windows\system32\tabctl32.ocx
2008-10-29 23:07 . 2007-08-10 12:56 155,648 –a—— c:\windows\system32\ciplImageList.ocx
2008-10-29 23:06 . 2008-10-29 23:06 d——– c:\documents and settings\HP_Administrator.MRWOFFICE\Application Data\InstallShield
2008-10-29 21:04 . 2008-10-29 21:04 d——– c:\windows\system32\LogFiles
2008-10-29 20:54 . 2008-10-29 20:54 d——– c:\program files\Windows Sidebar
2008-10-29 20:53 . 2008-11-01 06:58 10,671 –a—— c:\windows\system32\drivers\SYMEVENT.CAT
2008-10-29 20:53 . 2008-11-01 06:58 805 –a—— c:\windows\system32\drivers\SYMEVENT.INF
2008-10-29 18:23 . 2008-10-29 18:23 d——– C:\MSXML3msms

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-13 04:01 10,607 —-a-w c:\program files\hijackthis.log
2008-11-12 02:56 ——— d—–w c:\program files\Common Files\Adobe
2008-11-10 00:13 ——— d—–w c:\program files\WildTangent
2008-11-08 05:08 ——— d–h–w c:\program files\InstallShield Installation Information
2008-11-07 16:04 ——— d—–w c:\program files\Common Files\Real
2008-11-06 16:16 ——— d—–w c:\program files\Linksys EasyLink Advisor
2008-11-01 14:05 ——— d—–w c:\program files\Norton SystemWorks
2008-11-01 14:05 ——— d—–w c:\program files\Common Files\Symantec Shared
2008-11-01 13:32 ——— d–h–w c:\documents and settings\All Users\Application Data\Symantec
2008-10-31 07:19 ——— d—–w c:\program files\Kodak
2008-10-31 07:17 ——— d–h–w c:\documents and settings\All Users\Application Data\Kodak
2008-10-31 04:22 ——— d—–w c:\program files\Hewlett-Packard
2008-10-31 04:04 139,264 —-a-w c:\windows\system32\hpzjrd01.dll
2008-10-29 23:05 ——— d—–w c:\program files\Quicken
2008-10-29 22:41 ——— d—–w c:\program files\PC-Doctor 5 for Windows
2008-10-29 22:39 ——— d—–w c:\program files\Google
2008-10-29 22:24 ——— d—–w c:\program files\Java
2008-10-29 14:42 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\Vso
2008-10-24 11:21 455,296 —-a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-10 14:01 ——— d—–w c:\documents and settings\HP_Administrator\Application Data\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\INITIO
2008-10-09 18:05 ——— d—–w c:\program files\Common Files\ArcSoft
2008-10-09 18:05 ——— d—–w c:\program files\ArcSoft
2008-10-05 00:20 ——— d—–w c:\program files\InterVideo
2008-10-04 13:44 ——— d–h–w c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-30 22:43 1,286,152 —-a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 —-a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\msxml6.dll
2008-09-10 01:14 1,307,648 ——w c:\windows\system32\dllcache\msxml6.dll
2008-09-04 17:15 1,106,944 —-a-w c:\windows\system32\msxml3.dll
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 —-a-w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 —-a-w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 —-a-w c:\windows\system32\dllcache\ieakui.dll
2007-09-09 12:18 47,360 ——w c:\documents and settings\HP_Administrator\Application Data\pcouffin.sys
2005-05-26 19:35 1,422 —-a-w c:\program files\ReadMe.txt
2007-03-07 01:32 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007030620070307\index.dat
2007-06-23 23:29 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062320070624\index.dat
2007-06-27 02:23 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007062620070627\index.dat
.

——- Sigcheck ——-

2005-03-01 18:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2006-12-19 10:12 2059392 ba4b97c00a437c1cc3da365d93ee1e9d c:\windows\$hf_mig$\KB929338\SP2QFE\ntkrnlpa.exe
2007-02-28 03:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
2008-08-14 14:39 2066048 a25e9b86effb2af33bf51e676b68bfb0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
2004-08-03 21:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
2005-03-01 18:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\$NtUninstallKB929338$\ntkrnlpa.exe
2006-12-19 06:55 2057600 1d659bfb788ed2ba45075624b748d249 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
2008-08-14 03:33 2066048 4ac58f03eb94a72809949d757fc39d80 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2008-04-13 12:31 2065792 109f8e3e3c82e337bb71b6bc9b895d61 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
2008-08-14 03:33 2023936 8206b5f94a6a9450e934029420c1693f c:\windows\system32\ntkrnlpa.exe

2005-03-01 19:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2006-12-19 10:51 2182016 cef243f6defd20be4adde26c7ecacb54 c:\windows\$hf_mig$\KB929338\SP2QFE\ntoskrnl.exe
2007-02-28 03:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
2008-08-14 15:11 2189184 31914172342bff330063f343ac6958fe c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
2004-08-03 22:20 2180992 ce218bc7088681faa06633e218596ca7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
2005-03-01 18:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\$NtUninstallKB929338$\ntoskrnl.exe
2006-12-19 08:17 2180352 8f0deab1f81fb83f9c5995853ce48b9f c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
2008-08-14 04:11 2189184 eeaf32f8e15a24f62becb1bd403bb5c5 c:\windows\Driver Cache\i386\ntoskrnl.exe
2008-04-13 13:27 2188928 0c89243c7c3ee199b96fcc16990e0679 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
2008-08-14 04:09 2145280 f6f8245b3a2e9ca834dd318e7ae0c6d0 c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((( snapshot@2008-11-13_22.11.27.20 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 18:02:28 163,328 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\ERDNT.EXE
+ 2008-11-14 15:20:27 2,818,048 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\Users\00000001\NTUSER.DAT
+ 2008-11-14 15:20:27 159,744 —-a-w c:\windows\ERDNT\AutoBackup\11-14-2008\Users\00000002\UsrClass.dat
- 2008-11-08 05:10:46 61,558 —-a-w c:\windows\system32\perfc009.dat
+ 2008-11-14 15:24:18 61,558 —-a-w c:\windows\system32\perfc009.dat
- 2008-11-08 05:10:46 402,576 —-a-w c:\windows\system32\perfh009.dat
+ 2008-11-14 15:24:18 402,576 —-a-w c:\windows\system32\perfh009.dat
+ 2008-11-14 21:56:05 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_d4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-05 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
""="c:\progra~1\MOZILL~1\FIREFOX.EXE" [2008-11-12 7676528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"DISCover"="c:\program files\DISC\DISCover.exe" [2005-11-11 1064960]
"DiscUpdateManager"="c:\program files\DISC\DiscUpdateMgr.exe" [2005-11-11 61440]
"DMAScheduler"="c:\program files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe" [2005-11-01 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-09 249856]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb11.exe" [2004-04-06 172032]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-06 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-02-15 1052672]
"APVXDWIN"="c:\program files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" [2008-07-16 857344]
"SCANINICIO"="c:\program files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe" [2008-07-07 50432]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-14 57344]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-03 c:\windows\arpwrmsg.exe]

c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
TheSpringBox.lnk - c:\program files\TheSpringBox\TheSpringBox.exe [2007-06-14 1695679]

c:\documents and settings\HP_Administrator.MRWOFFICE\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
ATI CATALYST System Tray.lnk - c:\program files\ATI Technologies\ATI.ACE\CLI.exe [2005-08-14 57344]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 282624]
MarketBrowser.lnk - c:\program files\MarketBrowser\lmt\mktbrws.exe [2008-10-28 2971648]
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= c:\windows\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= c:\windows\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2008-03-18 16:58 58672 c:\windows\system32\avldr.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]
backup=c:\windows\pss\TotalMedia Backup Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
backup=c:\windows\pss\Updates From HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
–a—— 2006-04-02 20:07 389120 c:\program files\Linksys EasyLink Advisor\Linksys EasyLink Advisor\LinksysAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2007-05-08 16:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 pavboot;Panda boot driver;c:\windows\system32\Drivers\pavboot.sys [2008-06-19 28544]
R1 APPFLT;App Filter Plugin;c:\windows\system32\Drivers\APPFLT.SYS [2008-06-25 73728]
R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\Drivers\DSAFLT.SYS [2008-06-18 52992]
R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\Drivers\fnetmon.SYS [2008-03-28 22072]
R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\Drivers\IDSFLT.SYS [2008-06-18 193792]
R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\Drivers\NETFLTDI.SYS [2008-07-11 14:58 158848]
R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\Drivers\ShlDrv51.sys [2008-03-04 41144]
R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\Drivers\WNMFLT.SYS [2008-06-18 46720]
R2 Gwmsrv;Panda Goodware Cache Manager;c:\windows\system32\svchost -k Panda [ ]
R2 PavProc;Panda Process Protection Driver;c:\windows\system32\DRIVERS\PavProc.sys [2008-02-07 179640]
R2 PskSvcRetail;Panda PSK service;c:\program files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe [2008-06-25 28928]
R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys [ ]
R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\DRIVERS\COMFiltr.sys [2008-11-14 13880]
R3 NETIMFLT01060034;PANDA NDIS IM Filter Miniport v1.6.0.34;c:\windows\system32\DRIVERS\neti1634.sys [2008-06-26 197888]
R3 PavSRK.sys;PavSRK.sys;c:\windows\system32\PavSRK.sys [ ]
R3 PavTPK.sys;PavTPK.sys;c:\windows\system32\PavTPK.sys [ ]
S3 GameConsoleService;GameConsoleService;c:\program files\WildTangent\Apps\HP Game Console\GameConsoleService.exe [2008-05-05 165416]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
panda REG_MULTI_SZ Gwmsrv
.
Contents of the 'Scheduled Tasks' folder

2008-11-11 c:\windows\Tasks\At1.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At10.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At11.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At12.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At13.job
- c:\windows\system32\V032CCNE.exe []

2008-11-15 c:\windows\Tasks\At14.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At15.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At16.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At17.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At18.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At19.job
- c:\windows\system32\V032CCNE.exe []

2008-11-07 c:\windows\Tasks\At2.job
- c:\windows\system32\V032CCNE.exe []

2008-11-15 c:\windows\Tasks\At20.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At21.job
- c:\windows\system32\V032CCNE.exe []

2008-11-12 c:\windows\Tasks\At22.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At23.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At24.job
- c:\windows\system32\V032CCNE.exe []

2008-11-11 c:\windows\Tasks\At25.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At26.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At27.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At28.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At29.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At3.job
- c:\windows\system32\V032CCNE.exe []

2008-11-15 c:\windows\Tasks\At30.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At31.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At32.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At33.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At34.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At35.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At36.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At37.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-15 c:\windows\Tasks\At38.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At39.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-07 c:\windows\Tasks\At4.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\At40.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At41.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At42.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At43.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-15 c:\windows\Tasks\At44.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At45.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-12 c:\windows\Tasks\At46.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-14 c:\windows\Tasks\At47.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-13 c:\windows\Tasks\At48.job
- c:\windows\system32\7dfxYxG7.exe []

2008-11-08 c:\windows\Tasks\At5.job
- c:\windows\system32\V032CCNE.exe []

2008-11-15 c:\windows\Tasks\At6.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At7.job
- c:\windows\system32\V032CCNE.exe []

2008-11-08 c:\windows\Tasks\At8.job
- c:\windows\system32\V032CCNE.exe []

2008-11-13 c:\windows\Tasks\At9.job
- c:\windows\system32\V032CCNE.exe []

2008-11-14 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\pexpress\hphped05.exe [2004-06-06 22:53]

2008-11-12 c:\windows\Tasks\RegCure Program Check.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]

2008-11-10 c:\windows\Tasks\RegCure.job
- c:\program files\RegCure\RegCure.exe [2007-06-25 12:08]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-15 13:08:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-15 13:09:05
ComboFix-quarantined-files.txt 2008-11-15 19:09:02
ComboFix2.txt 2008-11-14 16:17:45
ComboFix3.txt 2008-11-14 04:11:47

Pre-Run: 72,329,134,080 bytes free
Post-Run: 72,343,654,400 bytes free

439 — E O F — 2008-11-12 18:04:36

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:21:58 PM, on 11/15/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\AVENGINE.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MarketBrowser\lmt\mktbrws.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ALCXMNTR.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Inicio.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [] C:\PROGRA~1\MOZILL~1\FIREFOX.EXE http://www.symantec.com/techsupp/servlet/P…000097.000001cf
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MarketBrowser.lnk = C:\Program Files\MarketBrowser\lmt\mktbrws.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430014015
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1225430005718
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Security, S.L. - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe
O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\pavsrv51.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
O23 - Service: Panda Host Service (PSHost) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\Firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PsImSvc.exe
O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\PskSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Antivirus Pro 2009\TPSrv.exe

–
End of file - 9698 bytes

little eagle

Post #15November 15, 2008, 7:57 PM UTC

Run this online scan from ESET

You will need to use Internet explorer for this scan!

First, accept the Terms of Use
Click: Start
When asked, allow the ActiveX control to install
Click: Start
Make sure the options:
Remove found threats, and Scan unwanted applications
are both checked!
Click: Scan

When the scan finishes, use Notepad to open the ESET report.
It will be located here C:\Program Files\EsetOnlineScanner\log.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Event Log error (at41.job)

✨ Ask AI

Ask AI